Senior Endpoint Security Specialist - Global Security Organization

Senior Endpoint Security Specialist - Global Security Organization

Location:

New York

Employment Type:

Regular

Job Code: A107710A

The mission of Tik Tok's Global Security Organization is to build and earn trust by reducing risk and securing our businesses and products. Also known as "GSO", this team is the foundation of our efforts to keep Tik Tok safe, secure, and operating at scale for over 1 billion people around the world. We work to ensure that the Tik Tok platform is safe and secure, that our users' experience and their data remains safe from external or internal threats, and that we comply with global regulations wherever Tik Tok operates.

Trust is one of Tik Tok's biggest initiatives, and security is integral to our success. In whatever ways users interact with us — whether they're watching videos on their For You page, interacting with a Live video, or buying products on Tik Tok Shop — GSO protects their data and privacy, so they can have a secure and trustworthy experience.

Sec Ops Validation Team (STOV) is responsible for the tools and technologies that support the Tik Tok infrastructure. STOV oversees technical validation, security operations, and drives engineering enhancements, including the deployment, configuration, and maintenance of security technologies across various domains.

• Build automated, repeatable validation workflows using infrastructure-as-code and automation frameworks to continuously validate technical control efficacy across servers (Linux/Windows), endpoints (macOS/Windows), email systems, IoT devices, and physical infrastructure.
• Conduct STRIDE-based threat modeling on new services/infrastructure, building secure design libraries (cryptography, input validation) to enforce patterns and prevent vulnerabilities. Plan and execute assessments to test host-based detection/prevention controls under realistic attack scenarios, including EDR evasion, defense-bypass methods, and post-exploitation tradecraft.
• Design and implement fault-tolerant, real-time data ingestion pipelines (Apache Flink/Spark Streaming, Kafka) and columnar data lakes (Click House) to process petabytes of global endpoint security telemetry (HIDS, EDR, NDR, audit logs, IDS/IPS).
• Build technical roadmaps and lead full-stack development of internal endpoint security tools, including technical validation platforms, scanners, secrets management integrations, and IAM policy engines—from gRPC/Protobuf API design to Kubernetes deployment with Istio service mesh.
• Develop and harden core detection engineering platforms, enabling Sigma/YARA-L rule codification, automated backtesting against historical data, and CI/CD deployment to SIEM (Splunk ES, Chronicle) and EDR endpoints.
• Research emerging MITRE ATT&CK TTPs, prototype behavioral analytics and ML-driven anomaly detection models to identify stealthy adversaries evading traditional signature-based defenses, and establish measurable technical security controls aligned to NIST, CIS, and MITRE ATT&CK frameworks for enterprise environments spanning servers, endpoints, email, IoT, and physical infrastructure.
• Build low-code/no-code validation playbooks and microservices to automate technical validation workflows, integrating with CMDBs, ITSM tools, and infrastructure APIs for issue remediation.

Minimum Qualifications:

• Platform & Infrastructure Expertise:
  Deep hands‑on experience with server (Linux, Windows), Kubernetes, and enterprise endpoint (macOS, Windows) technologies, with a track record of balancing security posture against operational and user‑experience requirements.
• Adversary Simulation
  
  Experience:
  
  Proven experience simulating advanced threat actor behavior in live, production‑scale environments using Breach‑and‑Attack Simulation (BAS) frameworks and tooling.
• Threat Intelligence:
  Deep working knowledge of attacker Tactics, Techniques, and Procedures (TTPs) mapped to the MITRE ATT&CK framework, with experience translating threat intelligence into actionable detection rules.
• Engineering & Development:
  Proficiency in at least one programming or scripting language (Python, Go, Bash, or C/C++) with strong debugging and automation skills.
• Offens…